|
| 1 | +name: Core / Notify maintainers on fork PRs not running integration tests |
| 2 | + |
| 3 | +on: |
| 4 | + pull_request_target: |
| 5 | + types: [opened, reopened, synchronize] |
| 6 | + |
| 7 | +permissions: |
| 8 | + contents: read |
| 9 | + pull-requests: write |
| 10 | + |
| 11 | +env: |
| 12 | + NON_TEST_SECRETS: "SLACK_WEBHOOK_URL_NOTIFICATIONS" |
| 13 | + |
| 14 | +jobs: |
| 15 | + notify: |
| 16 | + if: github.event.pull_request.head.repo.fork == true |
| 17 | + runs-on: ubuntu-slim |
| 18 | + steps: |
| 19 | + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 20 | + with: |
| 21 | + ref: ${{ github.event.pull_request.base.sha }} |
| 22 | + |
| 23 | + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 |
| 24 | + with: |
| 25 | + python-version: "3.13" |
| 26 | + |
| 27 | + - name: Detect integrations requiring API keys for integration tests |
| 28 | + id: affected |
| 29 | + shell: python |
| 30 | + env: |
| 31 | + GH_TOKEN: ${{ github.token }} |
| 32 | + PR_NUMBER: ${{ github.event.pull_request.number }} |
| 33 | + run: | |
| 34 | + import os |
| 35 | + import re |
| 36 | + import subprocess |
| 37 | + from pathlib import Path |
| 38 | +
|
| 39 | + WORKFLOWS_DIR = Path(".github/workflows") |
| 40 | + NON_TEST_SECRETS = set(os.environ["NON_TEST_SECRETS"].split()) |
| 41 | + SECRET_REF = re.compile(r"secrets\.([A-Z0-9_]+)") |
| 42 | +
|
| 43 | +
|
| 44 | + def needs_api_key(integration: str) -> bool: |
| 45 | + wf = WORKFLOWS_DIR / f"{integration}.yml" |
| 46 | + if not wf.exists(): |
| 47 | + return False |
| 48 | + referenced = set(SECRET_REF.findall(wf.read_text())) |
| 49 | + return bool(referenced - NON_TEST_SECRETS) |
| 50 | +
|
| 51 | +
|
| 52 | + # 1. PR file list |
| 53 | + paths = subprocess.check_output( |
| 54 | + [ |
| 55 | + "gh", "pr", "view", os.environ["PR_NUMBER"], |
| 56 | + "--json", "files", "-q", ".files[].path", |
| 57 | + ], |
| 58 | + text=True, |
| 59 | + ).splitlines() |
| 60 | +
|
| 61 | + # 2. Integrations touched by this PR |
| 62 | + touched = set() |
| 63 | + for p in paths: |
| 64 | + parts = Path(p).parts |
| 65 | + if len(parts) >= 2 and parts[0] == "integrations": |
| 66 | + touched.add(parts[1]) |
| 67 | + elif ( |
| 68 | + len(parts) == 3 |
| 69 | + and parts[0] == ".github" |
| 70 | + and parts[1] == "workflows" |
| 71 | + and parts[2].endswith(".yml") |
| 72 | + and not parts[2].startswith("CI_") |
| 73 | + ): |
| 74 | + touched.add(parts[2].removesuffix(".yml")) |
| 75 | +
|
| 76 | + # 3. Of those, which need API keys |
| 77 | + affected = sorted(t for t in touched if needs_api_key(t)) |
| 78 | + print(f"touched = {sorted(touched)}") |
| 79 | + print(f"affected = {affected}") |
| 80 | +
|
| 81 | + list_value = "\n".join(f"- {name}" for name in affected) |
| 82 | + with open(os.environ["GITHUB_OUTPUT"], "a") as f: |
| 83 | + f.write(f"list<<EOF\n{list_value}\nEOF\n") |
| 84 | +
|
| 85 | + - name: Post or update sticky comment |
| 86 | + if: steps.affected.outputs.list != '' |
| 87 | + uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4 |
| 88 | + with: |
| 89 | + header: fork-pr-api-keys |
| 90 | + number: ${{ github.event.pull_request.number }} |
| 91 | + message: | |
| 92 | + **Heads-up for maintainers** |
| 93 | +
|
| 94 | + This PR is from a fork and touches integrations whose integration tests require API keys. |
| 95 | + Those tests are **skipped** in CI because fork PRs don't have access to repo secrets for security reasons. |
| 96 | +
|
| 97 | + Affected integrations: |
| 98 | + ${{ steps.affected.outputs.list }} |
| 99 | +
|
| 100 | + Please run the integration tests locally (`hatch run test:integration` inside each folder) before approving. |
| 101 | +
|
| 102 | + - name: Remove stale comment |
| 103 | + if: steps.affected.outputs.list == '' |
| 104 | + uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4 |
| 105 | + with: |
| 106 | + header: fork-pr-api-keys |
| 107 | + number: ${{ github.event.pull_request.number }} |
| 108 | + delete: true |
0 commit comments